Advanced hunting

Attack surface reduction rules: move from audit mode to block safely

Roll out Microsoft Defender attack surface reduction rules in rings: audit first, read the data in advanced hunting, add narrow exclusions, then block.